www.gitorious.org Git - gnutls:gnutls.git/blob - tests/suite/testcompat-main-openssl

1 #!/bin/sh

2

6 #

7 # Author: Nikos Mavrogiannopoulos

8 #

9 # This file is part of GnuTLS.

10 #

11 # Redistribution and use in source and binary forms, with or without modification,

12 # are permitted provided that the following conditions are met:

13 #

14 # 1. Redistributions of source code must retain the above copyright notice, this

15 # list of conditions and the following disclaimer.

16 # 2. Redistributions in binary form must reproduce the above copyright notice,

17 # this list of conditions and the following disclaimer in the documentation and/or

18 # other materials provided with the distribution.

19 # 3. Neither the name of the copyright holder nor the names of its contributors may

20 # be used to endorse or promote products derived from this software without specific

21 # prior written permission.

22 #

23 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY

24 # EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

25 # OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT

26 # SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,

27 # INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED

28 # TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR

29 # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

30 # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY

31 # WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

32

33 srcdir="${srcdir:-.}"

34 CLI="${CLI:-../../src/gnutls-cli$EXEEXT}"

35 unset RETCODE

36 if ! test -z "${VALGRIND}";then

37 VALGRIND="${LIBTOOL:-libtool} --mode=execute ${VALGRIND}"

38 fi

39

40 if test "${WINDIR}" != "";then

41 exit 77

42 fi

43

44 . $srcdir/../scripts/common.sh

45

46 PORT="${PORT:-$RPORT}"

47

48 SERV=openssl

49 OPENSSL_CLI="openssl"

50

51 echo "Compatibility checks using "`$SERV version`

52 $SERV version|grep -e 1\.0 >/dev/null 2>&1

53 SV=$?

54 if test $SV != 0;then

55 echo "OpenSSL 1.0.0 is required for ECDH and DTLS tests"

56 exit 77

57 fi

58

59 $SERV version|grep -e 1\.0\.1 >/dev/null 2>&1

60 SV2=$?

61

62 . ./testcompat-common

63

64 echo "#################################################"

65 echo "# Client mode tests (gnutls cli-openssl server) #"

66 echo "#################################################"

67

68 for ADD in "" ":%COMPAT" ":%NO_ETM" ":%NO_TICKETS" ":%DISABLE_SAFE_RENEGOTIATION"

69 do

70

71 if ! test -z "$ADD";then

72 echo ""

73 echo "** Modifier: $ADD"

74 fi

75

76 if test 0 = 1;then

77

78 # It seems debian disabled SSL 3.0 completely on openssl

79

80 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -ssl3 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

81 PID=$!

82 wait_server $PID

83

84 # Test SSL 3.0 with RSA ciphersuite

85 echo "Checking SSL 3.0 with RSA..."

86 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

87 fail $PID "Failed"

88

89 # Test SSL 3.0 with DHE-RSA ciphersuite

90 echo "Checking SSL 3.0 with DHE-RSA..."

91 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

92 fail $PID "Failed"

93

94 # Test SSL 3.0 with DHE-DSS ciphersuite

95 echo "Checking SSL 3.0 with DHE-DSS..."

96 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-DSS$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

97 fail $PID "Failed"

98

99 kill $PID

100 wait

101

102 fi

103

104 if test "$FIPS" != 1;then

105 #-cipher RSA-NULL

106 launch_bare_server $$ s_server -cipher NULL-SHA -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -Verify 1 -CAfile $CA_CERT &

107 PID=$!

108 wait_server $PID

109

110 # Test TLS 1.0 with RSA-NULL ciphersuite

111 echo "Checking TLS 1.0 with RSA-NULL..."

112 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+NULL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

113 fail $PID "Failed"

114

115 kill $PID

116 wait

117 fi

118

119 #-cipher RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA

120 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

121 PID=$!

122 wait_server $PID

123

124 # Test TLS 1.0 with RSA ciphersuite

125 echo "Checking TLS 1.0 with RSA..."

126 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

127 fail $PID "Failed"

128

129 # Test TLS 1.0 with DHE-RSA ciphersuite

130 echo "Checking TLS 1.0 with DHE-RSA..."

131 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

132 fail $PID "Failed"

133

134 # Test TLS 1.0 with DHE-RSA ciphersuite

135 echo "Checking TLS 1.0 with ECDHE-RSA..."

136 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-RSA:+CURVE-ALL$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

137 fail $PID "Failed"

138

139 # Test TLS 1.0 with DHE-DSS ciphersuite

140 echo "Checking TLS 1.0 with DHE-DSS..."

141 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-DSS$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

142 fail $PID "Failed"

143

144 kill $PID

145 wait

146

147 if test "$FIPS" != 1;then

148

149 #-cipher ECDHE-ECDSA-AES128-SHA

150 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC224_KEY -cert $ECC224_CERT -Verify 1 -named_curve secp224r1 -CAfile $CA_ECC_CERT &

151 PID=$!

152 wait_server $PID

153

154 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite

155 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP224R1)..."

156 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY </dev/null >/dev/null || \

157 fail $PID "Failed"

158

159 kill $PID

160 wait

161

162 fi

163

164 #-cipher ECDHE-ECDSA-AES128-SHA

165 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC384_KEY -cert $ECC384_CERT -Verify 1 -named_curve secp384r1 -CAfile $CA_ECC_CERT &

166 PID=$!

167 wait_server $PID

168

169 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite

170 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP384R1)..."

171 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY </dev/null >/dev/null || \

172 fail $PID "Failed"

173

174 kill $PID

175 wait

176

177 if test "$FIPS" != 1;then

178 #-cipher ECDHE-ECDSA-AES128-SHA

179 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1 -key $ECC521_KEY -cert $ECC521_CERT -Verify 1 -named_curve secp521r1 -CAfile $CA_ECC_CERT &

180 PID=$!

181 wait_server $PID

182

183 # Test TLS 1.0 with ECDHE-ECDSA ciphersuite

184 echo "Checking TLS 1.0 with ECDHE-ECDSA (SECP521R1)..."

185 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY </dev/null >/dev/null || \

186 fail $PID "Failed"

187

188 kill $PID

189 wait

190

191 fi

192

193 #-cipher PSK

194 launch_bare_server $$ s_server -quiet -www -accept $PORT -tls1 -keyform pem -certform pem -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -cipher PSK -psk 9e32cf7786321a828ef7668f09fb35db &

195 PID=$!

196 wait_server $PID

197

198 echo "Checking TLS 1.0 with PSK..."

199 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+PSK$ADD" --pskusername Client_identity --pskkey 9e32cf7786321a828ef7668f09fb35db --insecure </dev/null >/dev/null || \

200 fail $PID "Failed"

201

202 kill $PID

203 wait

204

205 if test $SV2 = 0;then

206 # Tests requiring openssl 1.0.1 - TLS 1.2

207 #-cipher RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA

208 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

209 PID=$!

210 wait_server $PID

211

212 echo "Checking TLS 1.2 with RSA..."

213 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

214 fail $PID "Failed"

215

216 echo "Checking TLS 1.2 with DHE-RSA..."

217 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-RSA$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

218 fail $PID "Failed"

219

220 echo "Checking TLS 1.2 with ECDHE-RSA..."

221 $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-RSA:+CURVE-ALL$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

222 fail $PID "Failed"

223

224 echo "Checking TLS 1.2 with DHE-DSS..."

225 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS$ADD" --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

226 fail $PID "Failed"

227

228 kill $PID

229 wait

230

231 if test "$FIPS" != 1;then

232 #-cipher ECDHE-ECDSA-AES128-SHA

233 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC224_KEY -cert $ECC224_CERT -Verify 1 -named_curve secp224r1 -CAfile $CA_ECC_CERT &

234 PID=$!

235 wait_server $PID

236

237 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP224R1)"

238 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY </dev/null >/dev/null || \

239 fail $PID "Failed"

240

241 kill $PID

242 wait

243 fi

244

245 #-cipher ECDHE-ECDSA-AES128-SHA

246 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC384_KEY -cert $ECC384_CERT -Verify 1 -named_curve secp384r1 -CAfile $CA_ECC_CERT &

247 PID=$!

248 wait_server $PID

249

250 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP384R1)"

251 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY </dev/null >/dev/null || \

252 fail $PID "Failed"

253

254 kill $PID

255 wait

256

257 if test "$FIPS" != 1;then

258 #-cipher ECDHE-ECDSA-AES128-SHA

259 launch_bare_server $$ s_server -quiet -www -accept $PORT -keyform pem -certform pem -tls1_2 -key $ECC521_KEY -cert $ECC521_CERT -Verify 1 -named_curve secp521r1 -CAfile $CA_ECC_CERT &

260 PID=$!

261 wait_server $PID

262

263 echo "Checking TLS 1.2 with ECDHE-ECDSA... (SECP521R1)"

264 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --insecure --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY </dev/null >/dev/null || \

265 fail $PID "Failed"

266

267 kill $PID

268 wait

269 fi #FIPS

270

271 fi #SV2

272

273 #-cipher PSK

274 launch_bare_server $$ s_server -quiet -www -accept $PORT -tls1_2 -keyform pem -certform pem -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -cipher PSK -psk 9e32cf7786321a828ef7668f09fb35db &

275 PID=$!

276 wait_server $PID

277

278 echo "Checking TLS 1.2 with PSK..."

279 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+PSK:+CURVE-ALL$ADD" --insecure --pskusername Client_identity --pskkey 9e32cf7786321a828ef7668f09fb35db </dev/null >/dev/null || \

280 fail $PID "Failed"

281

282 kill $PID

283 wait

284

285 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

286 PID=$!

287 wait_server $PID

288

289 # Test DTLS 1.0 with RSA ciphersuite

290 echo "Checking DTLS 1.0 with RSA..."

291 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+RSA$ADD" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

292 fail $PID "Failed"

293

294 kill $PID

295 wait

296

297 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

298 PID=$!

299 wait_server $PID

300

301 # Test DTLS 1.0 with DHE-RSA ciphersuite

302 echo "Checking DTLS 1.0 with DHE-RSA..."

303 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-RSA$ADD" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

304 fail $PID "Failed"

305

306 kill $PID

307 wait

308

309 launch_bare_server $$ s_server -quiet -accept $PORT -keyform pem -certform pem -dtls1 -timeout -dhparam params.dh -key $RSA_KEY -cert $RSA_CERT -dkey $DSA_KEY -dcert $DSA_CERT -Verify 1 -CAfile $CA_CERT &

310 PID=$!

311 wait_server $PID

312

313 # Test DTLS 1.0 with DHE-DSS ciphersuite

314 echo "Checking DTLS 1.0 with DHE-DSS..."

315 $VALGRIND $CLI $DEBUG -p $PORT 127.0.0.1 --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-DSS$ADD" --udp --insecure --x509certfile $CLI_CERT --x509keyfile $CLI_KEY </dev/null >/dev/null || \

316 fail $PID "Failed"

317

318 kill $PID

319 wait

320

321 done

322

323 echo "Client mode tests were successfully completed"

324 echo ""

325 echo "###############################################"

326 echo "# Server mode tests (gnutls server-openssl cli#"

327 echo "###############################################"

328 SERV="../../src/gnutls-serv$EXEEXT -q"

329

330 # Note that openssl s_client does not return error code on failure

331

332 for ADD in "" ":%COMPAT" ":%NO_ETM" ":%NO_TICKETS" ":%DISABLE_SAFE_RENEGOTIATION"

333 do

334

335 if ! test -z "$ADD";then

336 echo ""

337 echo "** Modifier: $ADD"

338 fi

339

340 if test 0 = 1;then

341

342 echo "Check SSL 3.0 with RSA ciphersuite"

343 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+RSA$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

344 wait_server $PID

345

346 $OPENSSL_CLI s_client -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

347 fail $PID "Failed"

348

349 kill $PID

350 wait

351

352 echo "Check SSL 3.0 with DHE-RSA ciphersuite"

353 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-RSA$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

354 wait_server $PID

355

356 $OPENSSL_CLI s_client -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

357 fail $PID "Failed"

358

359 kill $PID

360 wait

361

362 echo "Check SSL 3.0 with DHE-DSS ciphersuite"

363 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-SSL3.0:+DHE-DSS$ADD" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh & PID=$!

364 wait_server $PID

365

366 $OPENSSL_CLI s_client -host localhost -port $PORT -ssl3 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

367 fail $PID "Failed"

368

369 kill $PID

370 wait

371

372 fi

373

374 #TLS 1.0

375

376 # This test was disabled because it doesn't work as expected with openssl 1.0.0d

377 #echo "Check TLS 1.0 with RSA ciphersuite (SSLv2 hello)"

378 #launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

379 #wait_server $PID

380 #

381 #$OPENSSL_CLI s_client -host localhost -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

382 # fail $PID "Failed"

383 #

384 #kill $PID

385 #wait

386

387 if test "$FIPS" != 1;then

388 echo "Check TLS 1.0 with RSA-NULL ciphersuite"

389 launch_server $$ --priority "NONE:+NULL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+RSA:+DHE-RSA$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

390 wait_server $PID

391

392 $OPENSSL_CLI s_client -cipher NULL-SHA -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

393 fail $PID "Failed"

394

395 kill $PID

396 wait

397 fi

398

399 echo "Check TLS 1.0 with DHE-RSA ciphersuite"

400 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-RSA$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

401 wait_server $PID

402

403 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

404 fail $PID "Failed"

405

406 kill $PID

407 wait

408

409 echo "Check TLS 1.0 with DHE-DSS ciphersuite"

410 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+DHE-DSS$ADD" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh & PID=$!

411 wait_server $PID

412

413 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

414 fail $PID "Failed"

415

416 kill $PID

417 wait

418

419 echo "Check TLS 1.0 with ECDHE-RSA ciphersuite"

420 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-RSA:+CURVE-ALL$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!

421 wait_server $PID

422

423 #-cipher ECDHE-RSA-AES128-SHA

424 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

425 fail $PID "Failed"

426

427 kill $PID

428 wait

429

430 if test "$FIPS" != 1;then

431 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP224R1)"

432 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY --x509cafile $CA_ECC_CERT & PID=$!

433 wait_server $PID

434

435 #-cipher ECDHE-ECDSA-AES128-SHA

436 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $ECC224_CERT -key $ECC224_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

437 fail $PID "Failed"

438

439 kill $PID

440 wait

441 fi

442

443 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP256R1)"

444 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC256_CERT --x509keyfile $ECC256_KEY --x509cafile $CA_ECC_CERT & PID=$!

445 wait_server $PID

446

447 #-cipher ECDHE-ECDSA-AES128-SHA

448 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $ECC256_CERT -key $ECC256_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

449 fail $PID "Failed"

450

451 kill $PID

452 wait

453

454 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP384R1)"

455 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY --x509cafile $CA_ECC_CERT & PID=$!

456 wait_server $PID

457

458 #-cipher ECDHE-ECDSA-AES128-SHA

459 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $ECC384_CERT -key $ECC384_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

460 fail $PID "Failed"

461

462 kill $PID

463 wait

464

465 if test "$FIPS" != 1;then

466 echo "Check TLS 1.0 with ECDHE-ECDSA ciphersuite (SECP521R1)"

467 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY --x509cafile $CA_ECC_CERT & PID=$!

468 wait_server $PID

469

470 #-cipher ECDHE-ECDSA-AES128-SHA

471 $OPENSSL_CLI s_client -host localhost -tls1 -port $PORT -cert $ECC521_CERT -key $ECC521_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

472 fail $PID "Failed"

473

474 kill $PID

475 wait

476 fi

477

478 echo "Check TLS 1.0 with PSK ciphersuite"

479 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.0:+PSK:+CURVE-ALL$ADD" --pskpasswd $SERV_PSK --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!

480 wait_server $PID

481

482 #-cipher PSK-AES128-SHA

483 $OPENSSL_CLI s_client -host localhost -psk_identity Client_identity -psk 9e32cf7786321a828ef7668f09fb35db -tls1 -port $PORT crt_file=$CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep ":error:" && \

484 fail $PID "Failed"

485

486 kill $PID

487 wait

488

489 if test $SV2 = 0;then

490

491 echo "Check TLS 1.2 with DHE-RSA ciphersuite"

492 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-RSA$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

493 wait_server $PID

494

495 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

496 fail $PID "Failed"

497

498 kill $PID

499 wait

500

501 echo "Check TLS 1.2 with DHE-DSS ciphersuite"

502 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+DHE-DSS$ADD" --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh & PID=$!

503 wait_server $PID

504

505 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

506 fail $PID "Failed"

507

508 kill $PID

509 wait

510

511 echo "Check TLS 1.2 with ECDHE-RSA ciphersuite"

512 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-RSA:+CURVE-ALL$ADD" --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!

513 wait_server $PID

514

515 #-cipher ECDHE-RSA-AES128-SHA

516 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

517 fail $PID "Failed"

518

519 kill $PID

520 wait

521

522 if test "$FIPS" != 1;then

523 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP224R1)"

524 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC224_CERT --x509keyfile $ECC224_KEY --x509cafile $CA_ECC_CERT & PID=$!

525 wait_server $PID

526

527 #-cipher ECDHE-ECDSA-AES128-SHA

528 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $ECC224_CERT -key $ECC224_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

529 fail $PID "Failed"

530

531 kill $PID

532 wait

533 fi

534

535 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP256R1)"

536 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC256_CERT --x509keyfile $ECC256_KEY --x509cafile $CA_ECC_CERT & PID=$!

537 wait_server $PID

538

539 #-cipher ECDHE-ECDSA-AES128-SHA

540 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $ECC256_CERT -key $ECC256_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

541 fail $PID "Failed"

542

543 kill $PID

544 wait

545

546 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP384R1)"

547 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC384_CERT --x509keyfile $ECC384_KEY --x509cafile $CA_ECC_CERT & PID=$!

548 wait_server $PID

549

550 #-cipher ECDHE-ECDSA-AES128-SHA

551 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $ECC384_CERT -key $ECC384_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

552 fail $PID "Failed"

553

554 kill $PID

555 wait

556

557 if test "$FIPS" != 1;then

558 echo "Check TLS 1.2 with ECDHE-ECDSA ciphersuite (SECP521R1)"

559 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+ECDHE-ECDSA:+CURVE-ALL$ADD" --x509certfile $ECC521_CERT --x509keyfile $ECC521_KEY --x509cafile $CA_ECC_CERT & PID=$!

560 wait_server $PID

561

562 #-cipher ECDHE-ECDSA-AES128-SHA

563 $OPENSSL_CLI s_client -host localhost -tls1_2 -port $PORT -cert $ECC521_CERT -key $ECC521_KEY -CAfile $CA_ECC_CERT </dev/null 2>&1 | grep "\:error\:" && \

564 fail $PID "Failed"

565

566 kill $PID

567 wait

568 fi

569

570 echo "Check TLS 1.2 with PSK ciphersuite"

571 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-TLS1.2:+PSK:+CURVE-ALL$ADD" --pskpasswd $SERV_PSK --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT & PID=$!

572 wait_server $PID

573

574 #-cipher PSK-AES128-SHA

575 $OPENSSL_CLI s_client -host localhost -psk_identity Client_identity -psk 9e32cf7786321a828ef7668f09fb35db -tls1_2 -port $PORT crt_file=$CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep ":error:" && \

576 fail $PID "Failed"

577

578 kill $PID

579 wait

580

581 fi #SV2

582

583 # DTLS

584 echo "Check DTLS 1.0 with RSA ciphersuite"

585 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+RSA$ADD" --udp --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

586 wait_server $PID

587

588

589 $OPENSSL_CLI s_client -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

590 fail $PID "Failed"

591

592 kill $PID

593 wait

594

595

596 echo "Check DTLS 1.0 with DHE-RSA ciphersuite"

597 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-RSA$ADD" --udp --x509certfile $SERV_CERT --x509keyfile $SERV_KEY --x509cafile $CA_CERT --dhparams params.dh & PID=$!

598 wait_server $PID

599

600

601

602 $OPENSSL_CLI s_client -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

603 fail $PID "Failed"

604

605 kill $PID

606 wait

607

608

609 echo "Check DTLS 1.0 with DHE-DSS ciphersuite"

610 launch_server $$ --priority "NONE:+CIPHER-ALL:+SIGN-ALL:+COMP-NULL:+MAC-ALL:+VERS-DTLS1.0:+DHE-DSS$ADD" --udp --x509certfile $SERV_DSA_CERT --x509keyfile $SERV_DSA_KEY --dhparams params.dh & PID=$!

611 wait_server $PID

612

613

614 $OPENSSL_CLI s_client -host localhost -port $PORT -dtls1 -cert $CLI_CERT -key $CLI_KEY -CAfile $CA_CERT </dev/null 2>&1 | grep "\:error\:" && \

615 fail $PID "Failed"

616

617 kill $PID

618 wait

619

620 done

621

622 exit 0